AI Chatbot Phishing Assistant Scam on WhatsApp
A fake AI 'customer support assistant' on WhatsApp Business chats naturally with users, answering questions convincingly before steering them toward a phishing link or a direct request for payment details.
Part of: AI Chatbot Phishing Assistant Scam
Last reviewed: 5 July 2026
WhatsApp Business's automated reply and chatbot features are widely used by real companies, which gives a fraudulent AI-driven assistant an easy way to blend in and hold a fluid, on-topic conversation that feels far more convincing than an old-style scripted bot.
How this scam works on WhatsApp
A message arrives from a WhatsApp Business account styled like a bank, delivery company, or utility provider, powered by an AI chatbot that can answer follow-up questions naturally, reference order numbers, and adjust its tone based on what the victim types. This fluidity builds trust quickly, since the bot doesn't feel like the rigid keyword-matching systems people are used to distrusting.
Partway through the conversation, the bot introduces a 'verification link' to resolve a delivery issue, unlock an account, or claim a refund, leading to a phishing page that harvests login credentials or card details. Because the AI can respond to skepticism with reassuring, contextually appropriate answers, victims who raise doubts are often talked past them rather than shut down by a bot that can't understand the question.
Common red flags
- A WhatsApp Business account with a generic or slightly misspelled company name and no verified green checkmark
- Conversation flows unusually smoothly and adapts to unrelated questions, which is unusual for genuine automated support
- A verification or refund link is introduced mid-conversation that leads off WhatsApp to an unfamiliar domain
- Requests for a one-time passcode, full card number, or banking password during the chat
- The account was only created recently or has no prior message history when checked
- Urgency framing such as a delivery being held or an account being suspended unless you act immediately
How to protect yourself
- Verify a business account's green checkmark and cross-check the number against the company's official website contact page
- Never click links sent through an unsolicited WhatsApp chat, even if the conversation feels natural and well-informed
- Go directly to the company's official app or website to resolve any account or delivery issue instead of using the chat link
- Never share a one-time passcode, password, or full card number in a chat, regardless of how legitimate it sounds
- Ask the bot a question only the real company could reasonably know; inconsistent or evasive answers are a warning sign
- Report and block suspicious business accounts rather than continuing the conversation to 'test' them
How to report it
- Report and block the business account directly within WhatsApp using the in-app report feature
- Report the impersonated company name to the real business's fraud or security team
- Forward details to your national cybercrime or consumer protection reporting center
- Report any resulting financial loss to your bank immediately
Frequently asked questions
How is this different from an old-style scam chatbot?
AI-driven bots can hold a natural, adaptive conversation and respond convincingly to follow-up questions, making them harder to spot than the rigid keyword-based bots people learned to distrust.
Can a business account with a verified checkmark still be part of a scam?
Verified badges reduce risk but don't eliminate it entirely; always verify the link and never share sensitive credentials in chat regardless of verification status.